TASKING VX-toolset for ARM User Guide

Chapter 19. CERT C Secure Coding StandardThe CERT C Secure Coding Standard provides rules and recommendations for secure coding in the Cprogramming language. The goal of these rules and recommendations is to eliminate insecure codingpractices and undefined behaviors that can lead to exploitable vulnerabilities.The application of the securecoding standard will lead to higher-quality systems that are robust and more resistant to attack.This chapter contains an overview of the CERT C Secure Coding Standard recommendations and rulesthat are supported by the TASKING VX-toolset.For details see the CERT C Secure Coding Standard web site. For general information about CERTsecure coding, see www.cert.org/secure-coding.IdentifiersEach rule and recommendation is given a unique identifier. These identifiers consist of three parts:• a three-letter mnemonic representing the section of the standard• a two-digit numeric value in the range of 00-99• the letter "C" indicates that this is a C language guidelineThe three-letter mnemonic is used to group similar coding practices and to indicate to which category acoding practice belongs.The numeric value is used to give each coding practice a unique identifier. Numeric values in the rangeof 00-29 are reserved for recommendations, while values in the range of 30-99 are reserved for rules.C compiler invocationWith the C compiler option --cert you can enable one or more checks for the CERT C Secure CodingStandard recommendations/rules. With --diag=cert you can see a list of the available checks, or you canuse a three-letter mnemonic to list only the checks in a particular category. For example, --diag=pre listsall supported checks in the preprocessor category.19.1. Preprocessor (PRE)PRE01-CUse parentheses within macros around parameter namesParenthesize all parameter names in macro definitions to avoid precedence problems.855